CVE-2026-17329

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability where improper validation of endpoint URLs could allow an unauthenticated remote attacker to access internal or sensitive resources.

Exploitability

Exploitation is straightforward for an unauthenticated attacker due to the lack of authentication, authorization, or user interaction requirements.

Blast radius

Successful exploitation could lead to exposure of internal network resources, credentials, or cloud metadata services, potentially enabling lateral movement or data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, as this version includes the fix for CVE-2026-17329.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.